Devices

BR6104

The BR6104 is based on the ADM5106 SoC (ARM7TDMI) and Broad Net Technology real-time OS (SOHO.BIN).

BR6104K

The BR6104K is based on the ADM5120P (PQFP). It has one WAN Ethernet port and a 4 port LAN switch. The firmware contains the usual: Linux, Firewall, NAT, dhcp client and server, etc.

BR6104K is actually the same model as BR6104KP, but without USB connector, 48MHz oscillator e.t.c. soldered on the board, and without printer support in the firmware. It is possible to add the missing USB parts and have a full BR6104KP model. The instructions are there. Edimax BR6104K/KP is rebranded Sweex LB000021 so PCBs are identical (PCB REV B. uses one DRAM chip, REV A two ones).

BR6104KP

The BR6104KP is the same as the BR6104K but has two USB 1.1 master ports that can be used to connect a printer and use it as a print server. Also you can use USB Flash disk for root filesystem (needed patch for usb root device). The 6104KP model is not sold in the UK, possibly due to problems gaining approval/certification.

BR6104W

BR6104WB

BR6104WG

BR6104Wg

The BR6014Wg is based on the ADM5120 (BGA) and has one WAN port and 4 port LAN swith. Additionally, it has a WiFi 802.11G MiniPCI card: AirVast WN360g, which based on the Intersil / GlobespanVirata / Conexant PRISM GT chipset.

The uploading is done with the XModem protocol. A CSYS header consists of 12 bytes: "CSYS\x00\x00\x50\x80" (8 bytes) followed by the length of the kernel (4-byte word, little-endian).

Tip: I experienced a lot of problems with the XModem transfers, which seemed to have something to do with the start of the transfer. For me, it helps to type some junk into the router, before starting up the XModem protocol. So I type "a" for upload to flash, then hold the arrow-up key for a couple of seconds, then start the transfer. However, this might be voodoo, your mileage may vary.

From Linux you can automate this process with a script (requires pexpect). The script seems to reliably work around the XModem issues (>20 transfers so far without problems).

JTAG

Shell access

Some models were observed to display an username/password prompt on the serial console after booting. If username "super" and password "@gogolinux" is entered, it drops to a shell.

My PS-3205U likes more username "edimax" with password "software01". I've found it easily by applying "strings AP/mkimg/image/bin/setup". As you can see, the /bin/setup program is the one you talk to at /dev/ttyS1.